Title: Machine learning based low-rate DDoS attack detection for SDN enabled IoT networks

Authors: Haosu Cheng; Jianwei Liu; Tongge Xu; Bohan Ren; Jian Mao; Wei Zhang

Addresses: Key Laboratory of Aerospace Network Security, Ministry of Industry and Information Technology, School of Electronic and Information Engineering, Beihang University, Beijing, 100191, China ' Key Laboratory of Aerospace Network Security, Ministry of Industry and Information Technology, School of Cyber Science and Technology, Beihang University, Beijing, 100191, China ' Key Laboratory of Aerospace Network Security, Ministry of Industry and Information Technology, School of Cyber Science and Technology, Beihang University, Beijing, 100191, China ' Key Laboratory of Aerospace Network Security, Ministry of Industry and Information Technology, School of Cyber Science and Technology, Beihang University, Beijing, 100191, China ' Key Laboratory of Aerospace Network Security, Ministry of Industry and Information Technology, School of Cyber Science and Technology, Beihang University, Beijing, 100191, China ' Experimental Teaching Center, ShanDong University of Finance and Economics, Jinan, 250014, China

Abstract: The software-defined network (SDN) enabled internet of things (IoT) architecture is deployed in many industrial systems. The ability of SDN to intelligently route traffic and use underutilised network resources, enables IoT networks to cope with data onslaught smoothly. SDN also eliminates bottlenecks and helps to process IoT data efficiently without placing a larger strain on the network. The SDN-based IoT network is vulnerable to DDoS attack in a sophisticated usage environment. The SDN-based IoT network behaviours are different from traditional networks, which makes the detection of low-traffic DDoS attacks more difficult. In this paper, we propose a learning-based detection approach that deploys learning algorithms and utilizes stateful and stateless features from Openflow packages to identify attack traffics in SDN control and data planes. Our prototype approach and experiment results show that our system identified the low-rate DDoS attack traffic accurately with relatively low system performance overheads.

Keywords: IoT; internet of things; software-defined networking; industrial system; low-rate distributed denial-of-service; machine learning.

DOI: 10.1504/IJSNET.2020.109720

International Journal of Sensor Networks, 2020 Vol.34 No.1, pp.56 - 69

Received: 12 Dec 2019
Accepted: 05 Mar 2020
Published online: 21 Sep 2020 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article